Hackers Hijack Temperature Controls of French Supermarket Fridges, Causing Overheating
What Happened – Attackers gained remote control of the software that regulates temperature on Danfoss‑manufactured refrigeration units used by a French supermarket chain. They commanded the units to heat up to ≈ 50 °C (120 °F) overnight, forcing freezers to stay warm. The compromised units were older models whose firmware could not be updated to address a known vulnerability.
Why It Matters for Trust & Control Assurance
- The incident shows how unpatched IoT assets can become a vector for operational disruption, a scenario continuous control‑assurance programs are built to detect and document.
- Demonstrating a documented vendor‑risk oversight process (evidence of firmware‑update policies, patch‑status monitoring) provides defensible audit evidence across multiple frameworks.
Who Is Affected – Retail (supermarket) operators that rely on connected refrigeration, and IoT device manufacturers that ship equipment without a sustainable update path.
Recommended Actions
- Inventory all IoT refrigeration assets and verify their patchability or end‑of‑life status.
- Establish a vendor‑risk monitoring program that continuously collects evidence of security‑update capabilities and maps them to your control‑objective framework.
Technical Notes – The attackers exploited a firmware‑level vulnerability in legacy Danfoss refrigeration controllers that lacked a remote‑update mechanism. No public CVE has been assigned yet; the weakness is a classic “unpatchable firmware” issue. Source: https://www.schneier.com/blog/archives/2026/10/cyberattack-on-connected-fridges-in-france.html